“For most pentesters, that’s the point at which the customer report more or less writes itself,” said Adam Barnett, principal software engineer at Rapid7.
120 CVEs in the May Patch Tuesday — scope and severity
Microsoft published security updates on May Patch Tuesday to remediate 120 CVEs, including 17 rated critical. Of those 17 critical vulnerabilities, 14 were classed as remote code execution (RCE), two as elevation of privilege (EoP) flaws and one as an information disclosure vulnerability. Across the full list of 120 CVEs the majority were EoP (61), RCE (31) and information disclosure (14).
CVE-2026-41089: Netlogon stack-based buffer overflow — a domain controller priority
Adam Barnett urged “anyone responsible for securing a domain controller” to prioritize CVE-2026-41089. Microsoft classified the flaw as a critical stack-based buffer overflow in Windows Netlogon with a CVSS v3 base score of 9.8. Barnett warned it “could give attackers system privileges on the domain controller,” and noted that “No privileges or user interaction are required, and attack complexity is low, which suggests that creation of a reliable exploit might not be especially difficult for anyone with knowledge of the specific mechanism.”
CVE-2026-41096 and CVE-2026-42898: DNS client and Dynamics 365 On-Premises risks
Action1 director of vulnerability research Jack Bicer highlighted two other critical flaws sysadmins should watch closely. CVE-2026-41096 is a critical RCE in the Windows DNS client implementation with a CVSS score of 9.8; Bicer warned that “Because DNS is a core networking service used across enterprise environments, exploitation could impact a large number of systems rapidly.” He added that successful attacks “may lead to widespread endpoint compromise, ransomware deployment, credential harvesting, and operational disruption across corporate networks.”
Bicer also flagged CVE-2026-42898, a critical RCE bug in Microsoft Dynamics 365 On-Premises. According to the advisory, an authenticated attacker with low privileges could execute malicious code over the network by manipulating process session data within Dynamics CRM. As Bicer put it, “With no user interaction required, and the potential to impact systems beyond the vulnerable component's original security scope, this vulnerability poses serious enterprise risk.”
MDASH, WARP and the multi-model agentic discovery of 16 CVEs
Microsoft said in a blog post published on 12 May that its Windows Attack Research and Protection (WARP) team collaborated with the firm’s Autonomous Code Security (ACS) on a new agentic AI initiative that discovered 16 of the CVEs listed in this month’s Patch Tuesday. Taesoo Kim, VP of agentic security at Microsoft, described the new system — codenamed MDASH — as a “agentic security harness” that “uses over 100 specialized agents across multiple models to find novel vulnerabilities.”
Kim explained that “The multi-model agentic scanning harness runs a configurable panel of models. That includes SOTA models as the heavy reasoner, distilled models as a cost-effective debater for high-volume passes, and a second separate SOTA model as an independent counterpoint.” He added that “Disagreement between models is itself a signal: when an auditor flags something as suspect and the debater can’t refute it, that finding’s posterior credibility goes up.”
Rapid7’s Barnett also noted WARP’s role in uncovering multiple critical vulnerabilities and suggested they “likely know a great deal about the current state of AI-powered vulnerability research as it applies to Microsoft products.”
What this means for sysadmins, enterprise application owners, and security teams
- Sysadmins and domain-controller owners: Prioritize remediation of CVE-2026-41089 on domain controllers because of its 9.8 CVSS rating, the potential for system privileges, and the lack of required user interaction.
- Enterprise application owners (Dynamics 365): Treat CVE-2026-42898 as high-risk for business-application servers; an authenticated user with low privileges could turn a server into a remote execution platform by manipulating session data.
- Security operations and network teams: Pay close attention to CVE-2026-41096 in the Windows DNS client because Bicer warned that DNS exploitation “could impact a large number of systems rapidly,” with downstream risks including endpoint compromise and operational disruption.
Microsoft’s May disclosures combine a conventional catalogue of critical and privilege-escalation bugs with a notable debut for agentic, multi-model tooling in vulnerability discovery. The immediate practical step is clear: identify and remediate the highlighted critical CVEs — especially CVE-2026-41089, CVE-2026-41096 and CVE-2026-42898 — while security teams observe how agentic approaches like MDASH shape future research and detection workflows.
Source: Infosecurity Magazine — Microsoft Fixes 17 Critical Flaws in May Patch Tuesday
